Apparatus and method for secure delivery of data from a communication device

ABSTRACT

A system that incorporates the subject disclosure may perform, for example, providing an upload request to a mobile communication device to cause a secure device processor of the mobile communication device to perform a modification of data according to a data protection key to generate modified data and to perform an encryption of the modified data according to an upload transport key to generate encrypted modified data where the secure device processor is separate from and in communication with a secure element of the mobile communication device, and where the secure element receives master keys from a remote management server and stores the master keys to enable the upload transport key and the data protection key to be generated by the secure element without providing the master keys to the secure device processor. Other embodiments are disclosed.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.15/205,402, filed Jul. 8, 2016, which is a continuation of U.S.application Ser. No. 14/091,679, filed Nov. 27, 2013 (now U.S. Pat. No.9,413,759), which are incorporated herein by reference in theirentirety.

FIELD OF THE DISCLOSURE

The subject disclosure relates to an apparatus and method for securedelivery of data from a communication device.

BACKGROUND

Electronic devices are being utilized with more frequency to store dataand distribute the data to other devices. The data can often be privateor confidential, and users desire to have confidence that any data thatthey are providing to another device is being done securely to avoidunauthorized users from accessing the data.

BRIEF DESCRIPTION OF THE DRAWINGS

Reference will now be made to the accompanying drawings, which are notnecessarily drawn to scale, and wherein:

FIG. 1 depicts an illustrative embodiment of a system that enables useof a UICC and a secure device processor as part of a secure servicesplatform for a secure provisioning of a communication device;

FIG. 2 depicts an illustrative embodiment of a system including thecommunication device of FIG. 1 implementing authentication andmanagement functions, as well as provisioning functions;

FIGS. 3A-3B depict an illustrative embodiment of a system that can beused for securely uploading or otherwise delivering data from a mobilecommunication device to a recipient device;

FIGS. 4A-4B depict an illustrative embodiment of a system that can beused for provisioning devices that are engaged in securely uploading orotherwise delivering data;

FIGS. 5A-5B depict an illustrative embodiment of a system that can beused for securely uploading or otherwise delivering data from a mobilecommunication device to a recipient device;

FIG. 6 depicts an illustrative embodiment of a method used in portionsof the systems described in FIGS. 1-5B;

FIG. 7 depicts an illustrative embodiment of a communication system thatprovides media services including securely uploading or otherwisedelivering data from a mobile communication device to a recipientdevice;

FIG. 8 depicts an illustrative embodiment of a communication device thatcan provide for secure upload or otherwise delivery of data from amobile communication device to a recipient device; and

FIG. 9 is a diagrammatic representation of a machine in the form of acomputer system within which a set of instructions, when executed, maycause the machine to perform any one or more of the methods describedherein.

DETAILED DESCRIPTION

The subject disclosure describes, among other things, illustrativeembodiments in which a secure element and a secure device processor of amobile communication device can be utilized together to enable a secureupload or delivery of data from the mobile communication device toanother device, such as an application (function) server, another enduser device, a removable memory device, and so forth.

In one or more embodiments, master keys can be distributed to the secureelement, such as from a remote management server utilizing a mutualauthentication process, so that the secure element can store the masterkeys without providing the master keys to the secure device processor.In one or more embodiments, the secure element can derive other keys,such as an upload transport key and/or a data protection key (fromcorresponding ones of the master keys), which are each part of keysetsthat enable encryption and then decryption by different devices, such asan encryption by the secure device processor of the mobile communicationdevice and a decryption by the application server (or other recipientdevice). In one or more embodiments, a synchronization process can beutilized so that the derived keys of each keyset (e.g., a paired keysetof upload transport keys and/or a paired keyset of data protection keys)are the same to enable encryption and subsequent decryption and/or datamodification and subsequent data un-modification by different devices.

In one or more embodiments, the secure device processor can receive theupload transport key and the data protection key from the secure elementwithout receiving the master keys and can apply these keys to the datafor modification and/or encryption of the data. For instance, the dataprotection key can be utilized by the secure device processor formodifying the original data (e.g., data stored by the secure deviceprocessor or data stored in another memory of the mobile communicationdevice). This modification can include adding additional information tothe data (e.g., permission, authentication data, a time stamp, and soforth) and/or applying an encryption to the data. The upload transportkey can then be utilized by the secure device processor for applying anencryption to the already modified data. In one or more embodiments,each of the upload transport key and the data protection key can beutilized for separate encryptions resulting in a double encrypted data.

In one or more embodiments, the recipient device (the device receivingthe modified and encrypted data) can have only the upload transport keyor can have both the upload transport key and the data protection key.For instance, a recipient device may have only the upload transport keyso that the recipient device can decrypt the encrypted modified datainto modified data and can store the modified data without having theability to un-modify the data. In another example, the recipient devicecan have both of the data protection key and the upload transport key sothat both keys are applied to the encrypted modified data to provideaccess to the original data.

In one or more embodiments, the secure element (e.g., executing a secureupload management function), the secure device processor (e.g.,executing a secure upload engine) and/or a device processor can beseparate but in communication with each other. The secure element (e.g.,a Universal Integrated Circuit Card (UICC)) can be a highly securecomputing platform for storing secrets such as encryption keys andauthentication credentials, and can host and execute applets. The securedevice processor can be a processor that is logically and/or physicallyseparate from the device processor (and/or the secure element), and canoffer more security than the device processor, but not as much securityas the secure element. Examples of a secure device processor can includea Trusted Execution Environment (TEE) and an embedded Secure Element(eSE). In one or more embodiments, the secure upload engine of thesecure device processor in conjunction with a recipient device having acorresponding upload transport key and/or a corresponding dataprotection key can provide a secure means for controlling thedistribution and delivery of data.

Other embodiments are included in the subject disclosure.

One embodiment of the subject disclosure is a computer-readable storagedevice having executable instructions which, responsive to beingexecuted by a secure device processor of a mobile communication device,cause the secure device processor to perform operations that includerequesting an upload transport key and a data protection key from asecure element of the mobile communication device, where the securedevice processor is separate from the secure element and incommunication with the secure element, and where the secure elementstores master keys from which the upload transport key and the dataprotection key are generated by the secure element. The operations caninclude receiving the upload transport key and the data protection keywithout receiving the master keys. The operations can include obtainingdata for transmission to a recipient device. The operations can includeencrypting the data using the data protection key to generate a singleencrypted data. The operations can include encrypting the singleencrypted data using the upload transport key to generate a doubleencrypted data.

One embodiment of the subject disclosure is a method that includesproviding, by a server including a processor, an upload request to amobile communication device to cause a secure device processor of themobile communication device to perform a first encryption of dataaccording to a data protection key to generate a single encrypted dataand to perform a second encryption of the single encrypted dataaccording to an upload transport key to generate a double encrypteddata. The secure device processor can be separate from and incommunication with a secure element of the mobile communication device.The secure element can receive master keys from a remote managementserver and can store the master keys to enable the upload transport keyand the data protection key to be generated by the secure elementwithout providing the master keys to the secure device processor. Themethod can include receiving, by the server from the secure deviceprocessor, the double encrypted data. The method can include obtaining,by the server, a corresponding upload transport key. The method caninclude decrypting, by the server, the double encrypted data utilizingthe corresponding upload transport key to obtain the single encrypteddata. The method can include storing, by the server, the singleencrypted data in a memory accessible to the server.

One embodiment of the subject disclosure is a communication device thatincludes a secure element having a secure element memory that storesfirst executable instructions that, when executed by the secure element,facilitate performance of first operations. The first operations caninclude receiving master keys from a remote management server, storingthe master keys in the secure element memory, and generating an uploadtransport key and a data protection key from the master keys. Thecommunication device can also include a secure device processor having asecure device processor memory that stores second executableinstructions that, when executed by the secure device processor,facilitate performance of second operations. The second operations caninclude receiving the upload transport key and the data protection keyfrom the secure element without receiving the master keys. The secondoperations can include obtaining data for transmission to a recipientdevice, modifying the data using the data protection key to generate amodified data, and encrypting the modified data using the uploadtransport key to generate an encrypted modified data. The secure deviceprocessor can be separate from the secure element and in communicationwith the secure element.

In accordance with an embodiment of the disclosure, FIG. 1 depicts asystem 100 that includes a communication device 102 connected to orotherwise in communication with a network 122 and provided with a secureservices platform 110 enabling secure delivery of data from thecommunication device 102 to a recipient device (e.g., recipient device150 and/or secondary recipient device 175).

Device 102 can be loaded with a secure upload engine (e.g., loaded intoa Secure Device Processor (SDP) 106) and/or a secure upload managementfunction (e.g., loaded into a secure element 108) to enable or otherwisefacilitate secure delivery of data from the communication device 102 tothe recipient device, such as an application server, another end userdevice, a removable memory device, and so forth.

It will be appreciated that the communication device 102 may be anydevice, including a user device, which has a secure element and a securedevice processor. The term “user,” in this example, refers to a humanuser of the communication device. However, in other embodiments, theuser can be a machine that exchanges data with the communication device102 after being authenticated to the communication device. Communicationdevice 102 can include a device processor 104, the SDP 106 and thesecure element 108 (e.g., which can include a UICC). The secure element108 can be various types of smart cards including a SubscriberIdentification Module (SIM) card or other types of secure element. Thesecure element 108 can be a secure computing platform and can offer ahigh level of security for storing encryption keys, authenticationcredentials, and the like. The secure element 108 may be removable fromthe device. In other embodiments, the secure element 108 may be embeddedin the device and not removable. In other embodiments, the secureelement 108 can be placed on a memory card or an embedded chip.

The SDP 106 can be logically and/or physically separate from the deviceprocessor 104, and can be connected to both the device processor and thesecure element 108. In this embodiment, the SDP 106 can offer a higherlevel of security than the device processor 104, and can store andexecute secure applications. The SDP 106 can, for example, runapplications in a trusted execution environment. The secure element 108and SDP 106 together can form a secure services platform 110 resident onthe device 102. In this embodiment, the secure element 108, the SDP 106and the device processor 104 can each have a security level associatedtherewith, and the security level associated with the SDP 106 can beintermediate between that of the secure element 108 and that of thedevice processor 104. The SDP 106 and secure element 108 can use mutualauthentication, as described in more detail below.

The secure element 108 and the SDP 106 can communicate with a remotemanagement (function) server 120, located remotely from device 102. TheRemote Management Server (RMS) 120 can be a platform for provisioningand/or managing applications in the secure element 108 and the SDP 106.The RMS 120 can also manage data (such as keys, credentials, and soforth) that are used by the applications. Examples of remote managementservers are described in U.S. patent application Ser. No. 13/679,479filed on Nov. 16, 2012 and U.S. patent application Ser. No. 13/680,680filed on Nov. 19, 2012, the disclosures of both of which are herebyincorporated by reference.

In this embodiment, communication device 102 can be a wirelesscommunication device connected to a cellular network 122. Network 122can also be other types of networks operating according to variouscommunication protocols, such as a WiFi network. In other embodiments,device 102 can be connected to other devices via a wired connectionthrough a computer. In still other embodiments, user devices cancommunicate with each other using Bluetooth®, infrared communications(IRDa) and/or near field communications (NFC). A communication sessionbetween user devices, wherein information is transferred between theusers, can be effected by a wide variety of arrangements. A secureapplication server (SAS) can be used in some embodiments to establish asecure communication session between devices. However, in someembodiments a secure application server may not be used where thecommunication session is established in a peer-to-peer manner, such asin Bluetooth®, IRDa or NFC.

System 100 enables components of the secure services platform 110 (e.g.,a secure upload engine of the SDP 106) to perform operations includingone or more of requesting an upload transport key and a data protectionkey from a secure element 108 of the mobile communication device 102where the secure element stores master keys from which the uploadtransport key and the data protection key are generated by the secureelement, receiving the upload transport key and the data protection keywithout receiving the master keys, obtaining data for transmission to arecipient device, encrypting the data using the data protection key togenerate a single encrypted data, or encrypting the single encrypteddata using the upload transport key to generate a double encrypted data.In one or more embodiments, the secure upload engine of the SDP 106 canreceive an upload request received via a user interface of thecommunication device 102 where the obtaining of the data is in responseto the receiving of the upload request, receive a user credential viathe user interface, provide the user credential to the secure element108, and receive a user authentication from the secure element where therequesting of the upload transport key and the data protection key fromthe secure element is responsive to the receiving of the userauthentication.

In one or more embodiments, the secure upload engine of the SDP 106 canfacilitate establishing a communication channel with the recipientdevice and can provide the double encrypted data over the communicationchannel to the recipient device 150 and/or 175 to enable the recipientdevice to perform a first decryption of the double encrypted datautilizing a corresponding upload transport key. In one or moreembodiments, the secure element 108 can receive the master keys from aremote management server 120 where the recipient device receives fromthe remote management server the corresponding upload transport key or amaster transport key for deriving the corresponding upload transportkey. In one or more embodiments, the SDP 106 and the secure element 108can perform a mutual authentication with each other utilizing a keysetreceived via the remote management server 120, where the SDP can receivean upload request from one of the recipient device, anothercommunication device, an application being executed by the mobilecommunication device, or a user input received at the mobilecommunication device 102, and where the obtaining of the data is inresponse to the receiving of the upload request. In one or moreembodiments, the recipient device can be a removable memory devicehaving a connection port to enable a physical coupling with the mobilecommunication device, and wherein the SDP 106 can provide the doubleencrypted data to the removable memory device via the connection port toenable the recipient device to be removed from the mobile communicationdevice and subsequently coupled with an end user device for transmissionof the double encrypted data to the end user device to enable the enduser device to perform a first decryption of the double encrypted datautilizing a corresponding upload transport key. In one or moreembodiments, the SDP 106 can receive an upload request received via auser interface where the obtaining of the data is in response to thereceiving of the upload request, receive a user credential via the userinterface, provide the user credential to the secure element 108,receive a user authentication from the secure element, and request theupload transport key and the data protection key from the secure elementin response to the receiving of the user authentication.

System 100 enables components of the secure services platform 110 (e.g.,a secure upload management function of the secure element 108) toperform operations including one or more of receiving master keys fromthe remote management server 120, storing the master keys in a secureelement memory, and generating an upload transport key and a dataprotection key from the master keys. The secure element 108 can receivethe master keys from the remote management server 120, and can receive arequest from the secure device processor 106 for the upload transportkey and the data protection key, where the generating of the uploadtransport key and the data protection key is in response to the requestfrom the secure device processor. In one or more embodiments the secureelement 108 can be provisioned from the remote management server 120utilizing a remote management keyset.

System 100 enables components of the secure services platform 110 toupload or otherwise deliver data to the recipient device 150 and/or 175through the use of encryption and modification by the SDP 106 accordingto derived keys that are generated by the secure element 108 from masterkeys (which are inaccessible to the SDP 106). The recipient device 150can have access to one or more of the derived keys which can enable therecipient device to decrypt and un-modify the data so that the data isreturned to its original form or the recipient device 150 can havelimited access to the recipient keys such that the recipient data canonly decrypt the data without being able to un-modify the data. Otherdevices, such as secondary recipient device 175 can retrieve orotherwise obtain the data from the recipient device 150. In oneembodiment, other derived keys can subsequently be applied to the dataduring the delivery of the data from the recipient device 150 to thesecondary recipient device 175.

In one or more embodiments, the recipient device 150 can be a removablememory device (e.g., a memory stick) having a connection port (e.g., aUSB port) to enable a physical coupling with the communication device102, and the secure device processor can provide encrypted modified datato the removable memory device via the connection port to enable therecipient device to be removed from the mobile communication device andsubsequently coupled with an end user device 175 for transmission of theencrypted modified data to the end user device to enable the end userdevice to perform a decryption of the encrypted modified data utilizinga corresponding upload transport key.

In one or more embodiments, the derived key(s) (e.g., the dataprotection and upload transport keys) can be sent from the mobilecommunication device 102 (e.g., by the secure device processor 106) tothe recipient device 150 (e.g., the application server) along with theencrypted modified data (e.g., in the same data channel or in differentdata channels) by encrypting the derived keys, such as using anasymmetric encryption technique. This exemplary embodiment could beutilized as an alternative to a derived key synchronization methoddescribed herein. Whether a derived key synchronization procedure isutilized or whether a transmission of the derived keys procedure isutilized can depend on a number of factors, such as a relationshipbetween the mobile communication device 102 and the recipient device150, the nature of the data (e.g., highly confidential vs. low-levelconfidential)

FIG. 2 is a schematic illustration 200 showing details of a secureservices platform 110, according to an embodiment of the disclosure,which can be used with the communication device 102 of FIG. 1. Thesecure element 108 can contain an authentication management function 202and a real-time encryption key generator 204. The authenticationmanagement function 202 can provide authentication services for thedevice. For example, the authentication management function 202 cansupport mutual authentication of components of the device 102 or mutualauthentication between different devices. As shown in FIG. 2, theauthentication management function 202 can include a user authenticationservice 212 for authenticating the user to the device and a networkauthentication service 214 for authenticating the device to networkequipment. The real-time encryption key generator 204 can supplyencryption keys to a real-time encryption engine 206 which is located inthe SDP 106. The real-time encryption engine 206 can encrypt and decryptuser information transmitted to or from a bearer path 216 thatterminates at another device (e.g., another user device), and mayencrypt and decrypt information transmitted on a signaling path 218 tothe network. In another embodiment, the encryption engine can be loadedon a second secure element, separate from the secure element 108.

The RMS 120 can perform a remote provisioning and management function210 to load applications, content and/or other information (e.g.,various keysets) into the secure element 108 and/or SDP 106. In thisembodiment, the RMS 120 can provision the authentication managementfunction 202 and real-time encryption key generator 204 on the secureelement 108, and can provision the real-time encryption engine 206 onthe SDP 106. This can be done securely by the use of one or more remotemanagement keysets. In one embodiment, before the secure servicesplatform 110 can be used for communication, the SDP 106 can beauthenticated by the secure element 108. In one embodiment, this can bedone using a UICC-SDP keyset. The UICC-SDP keyset may be provisionedremotely by the RMS 120 or locally by an authorized user. In thisembodiment, after the secure element 108 and SDP 106 are mutuallyauthenticated using the UICC-SDP keyset, they can communicate via asignaling path 208 within the secure services platform 110. The UICC-SDPkeyset may be used for secure communication during initial loading andprovisioning. However, the keys being utilized may be different. In oneembodiment, the path between the secure element 108 and the SDP 106 cango through the device processor 104 rather than directly between thesecure element and the SDP.

In this embodiment of FIG. 2, the secure services platform 110 enablesthe secure delivery of data through encryption and modification by theSDP 106 according to derived keys that are generated from master keysstored by the secure element and which are inaccessible to the SDP 106.The modification of the data can include the adding of additionalinformation to the data, such as authentication data, permissions, timestamps, user credentials, digital rights management information and soforth. The modification can also include encryption, such that the datais doubly encrypted utilizing separate derived keys (e.g., the uploadtransport key and the data protection key).

Referring to FIGS. 3A-B, a system 300 is depicted which illustrates asecure process in which data can be securely uploaded or otherwisedelivered from a user device to a recipient device, such as anapplication server within the network, by using a secure element (whichmay exist within a UICC) and a secure device processor as a securedownload platform. The secure element can include a secure uploadmanagement function which can perform the following tasks: storing amaster set of keys and credentials; and/or providing derived keys to thesecure upload engine. The secure device processor can include the secureupload engine which can perform the following tasks: processing user,device, and/or network requests to upload data; communicating with anauthentication function to authenticate the user; authenticating andcommunicating with the secure upload application server to upload data;uploading data to the secure upload application server (or anotherrecipient device such as another end user device or a memory device);communicating with the secure upload management function to obtainderived keys; and/or modifying data as specified by the derived keys itobtains from the secure upload management function.

The secure upload application server of FIG. 3A can perform thefollowing tasks: storing uploaded data; decrypting and normalizing(e.g., un-modifying) data based on the keys it has stored;authenticating and communicating with the secure upload engine; storinga set of keys (e.g., derivative keys and/or master keys) provided to itby the remote management server; maintaining user information;processing requests from the user, another end user device and/or thenetwork to download content or applications; and/or storing uploadeddata. In one or more embodiments, the remote management server cancreate and load the secure upload applications described above into boththe secure element (e.g., a UICC) and the secure device processor. Theremote management server can also update the credentials and permissionsthat are stored in the secure upload management function. For example,these operations can be done securely by the use of one or more remotemanagement keysets. These keysets can be used to mutually authenticatethe UICC and the secure device processor with the remote managementserver and to enable encryption between them.

Referring to FIGS. 4A-B, system 400 is depicted which illustratesloading or otherwise provisioning the end user device(s) with theapplications that are utilized by the secure services platform forperforming the secure upload or delivery of data. Two applications canbe loaded or otherwise provisioned to the mobile communication device:the secure upload management function and the secure upload engine. Ifthe applications have not been loaded during the manufacturing processfor the mobile communication device, then at 1 a, upon receiving arequest for the service, the secure upload application server caninstruct the remote management server to download the secure uploadmanagement function to the UICC and to download the secure upload engineto the secure device processor. At 1 b, the remote management server candownload the secure upload management function to the UICC and thesecure upload engine to the secure device processor. Remote ManagementKeysets can be used to securely transmit information from the remotemanagement server to the mobile communication device. This process caninvolve mutual authentication and encryption. At 1 c, the UICC and thesecure device processor can mutually authenticate with each other oncethe two are provisioned using the UICC-SDP Keyset. At 1 d, an initialset of user credentials and master keysets are sent from the remotemanagement server to the secure upload management function. This caninclude a master upload transport keyset and a master dataprotection/encryption keyset. At 1 e, the remote management server caninstruct the secure upload engine to register and associate with anauthentication processor function. The secure upload engine can registerand associate with the authentication processor function. At 1 f, theremote management server can transmit the upload transport keyset to thesecure upload application server and may or may not also transmit thedata encryption keyset.

Referring to FIGS. 5A-B, system 500 is depicted which illustrates aprocess for securely uploading or delivering data from a mobilecommunication device to a recipient device through use of multiplederived keys that enable encryption and modification of the data. Thisprocess can involve the secure upload of data already stored in thedevice to the recipient device, which in this example is described as asecure upload application server, although various other devices can berecipient devices, such as other end user devices, memory devices, andso forth. As an example, the user can select data that is already storedin the device for transmission. This example is described according touser input by a user at the mobile communication device, however, theexemplary process can also be initiated according to an applicationexecuted by the mobile communication device or by another device. At 2a, the user selects a set of data that is stored in the device is to beuploaded securely to the secure upload application server. At 2 b, thesecure upload engine checks to see if the user has been previouslyauthenticated and, if so, whether or not the user needs to bere-authenticated. If the user is to be authenticated, the secure uploadengine can request for the authentication processor function toauthenticate the user. As an example, at 2 c, the authenticationprocessor function can prompt the user to authenticate, such as using apre-determined method. At 2 d, once the authentication processorfunction obtains the credential from the user, it processes thecredential for analysis by the authentication management function. At 2e, the authentication management function can analyze the credential andcan verify whether or not the user should be authenticated. At 2 f, onceauthentication is verified, the secure upload engine can request anupload transport key and a data protection key from the secure uploadmanagement function. These keys can be derived from a master set of keysstored within the secure upload management function. These keys may beused for a variety of security purposes including encryption andauthentication. The data protection key may also include other types ofinformation to protect the data including a time stamp and user definedcredentials. At 2 g, the secure upload engine can locate and retrievethe user selected data from the secure upload storage. In oneembodiment, the secure upload storage may not necessarily be within thesecure device processor, for example, it can be stored in a memory ofthe device processor 104. At 2 h, the secure upload engine can apply thederived data protection key to the data that was retrieved from thesecure upload storage. At 2 i, the secure upload engine can establish adata channel (or other communication connection depending on thecommunication protocol being utilized) with the secure uploadapplication server. The two can mutually authenticate with each otherusing the authentication parameters of the derived upload transport key.Once mutually authenticated, the secure upload engine can transmit thedata to the secure upload application server. The data may be encryptedusing the encryption parameters of the derived upload transport key. At2 j, the user can be notified if the transmission was successful or not.Re-transmission (of all or some of the data) can also be implemented bythe secure device processor, such as based on a detected transmissionerror. In one embodiment at 2 k, the secure upload application servercan decrypt the data using first the upload transport key and then againusing the data protection key if it has one. If the secure uploadapplication server has decrypted the data using the data protection key,the data is now subject to modification including the addition of newcredentials, file permissions, and/or re-encryption.

FIG. 6 depicts an illustrative embodiment of a method for providingsecure upload or delivery of data from a mobile communication device toa recipient device, such as an application server, another end userdevice, a removable memory device, and so forth. Method 600 is describedas being performed by the secure services platform 110, however, all ora portion of the steps of method 600 can be performed by various devicesor individual components of devices. More or less than the stepsdescribed in method 600 can be performed in one or more exemplaryembodiments, and the order of steps can be rearranged.

Method 600 can begin at 602 where one or more master keys are receivedand stored by the secure element 108 of the mobile communication device102. The secure element 108 can store the master keys (e.g., in a secureelement memory which can be a physically or logically isolated andseparate component from other memory of the mobile communication device102) without allowing other components or other devices to access thestored master keys, such as prohibiting the secure device processor 106and/or the device processor 104 from accessing the master keys. In oneor more embodiments, the master keys can be received from a remotemanagement server, where the remote management server can distributecorresponding master keys (for some or all of those master keys) toother devices (e.g., recipient devices 150 and/or 175). In oneembodiment, the provisioning of the master keys to the secure element108 can be performed utilizing a remote management keyset. In anotherembodiment, mutual authentication (e.g., of the secure element 108, thesecure device processor 106, and/or the remote management server 120)can be performed or required prior to the master keys being provisionedto the secure element 108.

In one embodiment at 604, a user that is associated with an uploadrequest (e.g., request to upload to an application server, request totransfer data to a removable memory device, request to transmit data toanother end user device or other device) can be authenticated. Forinstance, the authentication can be based on a user credential(s) thatis received by the secure device processor 106 via user input at themobile communication device 102, where the user credential is comparedwith a corresponding user credential stored by the secure element 108.Various types of user credentials can be used for user authentication,including user identification information, passwords, biometric data,and so forth. Various other types of authentication processes can beimplemented at the mobile device 102, such as described in U.S.application Ser. No. 14/061,380 filed on Oct. 23, 2013, the disclosureof which is hereby incorporated by reference.

In one or more embodiments, the upload request can be initiated based onuser input at the mobile communication device 102. However, the uploadrequest can be initiated by other sources, such as an upload requestinitiated by an application being executed on the mobile communicationdevice 102, which may or may not require user authentication (e.g., asperformed at 604). In one embodiment of this example, the upload requestcan be performed automatically without notice being provided to the userof the mobile communication device 102. In another embodiment of thisexample, the upload request can be initiated automatically but canprovide notice or request authorization from the user to proceed, suchas a notice or permission request being presented at the mobilecommunication device 102. In another embodiment, the upload request canbe initiated by another device, which may or may not require userauthentication (e.g., as performed at 604). For instance, an applicationserver or another end user device may transmit the upload request to themobile communication device 102 where it is processed by the securedevice processor 106.

At 606, derivative key(s) can be generated from the master key(s) by thesecure element 108. The derivative key(s) can be provided from thesecure element 108 to the secure device processor 106 without providingthe master key(s) to the secure device processor. For example, thesecure element 108 can generate an upload transport key and a dataprotection key from a master transport key and a master protection key,respectively, that are being stored by the secure element memory (whichis inaccessible to the secure device processor 106). The secure element108 can then provide the upload transport key and the data protectionkey to the secure device processor 106 without providing the mastertransport key and the master protection key to the secure deviceprocessor.

In one or more embodiments at 608, the generating of the derivative keysby the secure element 108 can be synchronized with a generation of acorresponding derivative key at another device, such as at the recipientdevice 150, the secondary recipient device 175, the remote managementserver 120, or another device that can provide the derivative key to therecipient device 150 and/or 175. The synchronization can occur innumerous ways, such as a notice to establish synchronization being sentby the secure element 108 to the device that will be generating thecorresponding derivative key(s). The notice can include information thatenables the corresponding key to be generated, including time data,identification data, and so forth.

The timing of the generation of the derivative keys can vary. Forexample, the secure element 108 can generate the derivative keys inresponse to a request for the derivative keys from the secure deviceprocessor 106. The request for the derivative keys can be provided bythe secure device processor 106 to the secure element 108 before orafter user authentication 604 (if performed). In one embodiment, some ofthese processes can be performed simultaneously to expedite the process.For instance, the initiation of the generation of the derivative keys bythe secure element 108 can be performed in response to a generationrequest from the secure device processor 106 which is triggered by theupload request. In this example, the user authentication at 604 can beperformed while the derivative keys are being generated. Continuing withthis example, in the event that the user authentication is notsuccessful or otherwise cannot be completed, the generated derivativekeys can be deleted or otherwise rendered inoperable by the secureelement 108 without providing the derivative keys to the secure deviceprocessor 106. In one embodiment, initiating generation of thederivative keys prior to the user authentication process being completedcan provide time for other steps that may be taken as part of thederivative key process, such as communication with a recipient devicefor synchronization of generation of corresponding derivative keys at608.

At 610, the secure device processor 106 can obtain the data that is tobe transmitted to the recipient device 150. The data can be stored atvarious locations of the mobile communication device, such as a secureupload storage of the secure device processor 106 which is logically orphysically isolated from other memory outside of the secure deviceprocessor. The data can also be obtained from the device processor 104,such as stored in a memory of the mobile communication device 102 thatis accessible to the device processor 104.

At 612, the data can be modified by the secure device processor 106using a first derivative key (e.g., the data protection key) to generatemodified data. The data modification process by the secure deviceprocessor 106, which utilizes the data protection key, can involveadding additional information to the data and/or encrypting the data.The additional information can be various types of information, such asauthentication data, permissions, timestamps, and so forth.

At 614, the secure device processor 106 can encrypt the modified datausing the upload transport key to generate an encrypted modified data.In one or more embodiments, the data is now double encrypted data (e.g.,a first encryption according to the data protection key and a secondencryption according to the upload transport key).

At 616, the encrypted modified data can be transmitted or provided bythe secure device processor 106, such as via a transceiver of the mobilecommunication device 102 that can be controlled by the device processor104, to the recipient device 150. This can be performed via a wirelesscommunication session (e.g., establishing a data channel) between themobile communication device 102 and the recipient device 150 or can beperformed via a physical connection with the recipient device 150, suchas where the recipient device 150 is a memory stick that has beenremovably connected with the mobile communication device via a UniversalSerial Bus (USB) port of the mobile communication device 102.

In one or more embodiments, first executable instructions (e.g., thesecure upload management function) can be provisioned to the secureelement memory and second executable instructions (e.g., the secureupload engine) can be provisioned to the secure device processor memoryfrom the remote management server 120, such as utilizing a remotemanagement keyset.

In one embodiment, the providing of the encrypted modified data to therecipient device can enable the recipient device to perform a decryptionof the encrypted modified data utilizing a corresponding uploadtransport key. In this example, the recipient device does not haveaccess to a corresponding data protection key so that the recipientdevice, after the decryption, provides storage only in the form ofmodified data (which may be encrypted data according to the dataprotection key). Further to this example, other devices, such as themobile communication device 102 or the secondary recipient device 175,can have the necessary data protection key so that the modified data canbe retrieved from the recipient device 150 and can be unmodified (e.g.,performing a second decryption based on the data protection key) toprovide access to the original data.

In another embodiment, the recipient device 150 can have both thecorresponding data protection key and the corresponding upload transportkey so that the encrypted modified data can be returned to, and storedin, its original form at the recipient device. Whether or not therecipient device has one or both of the corresponding data protectionkey and the corresponding upload transport key can depend on variousfactors, such as the type of data, ownership of the data, type ofrecipient device, identity of the entity operating the recipient device(e.g., a governmental authority vs. a private entity), and so forth.

In one or more embodiments, the recipient device(s) can receive from aremote management server a corresponding derived key (e.g., thecorresponding upload transport key and/or the corresponding dataprotection key) and/or can receive a master key(s) (e.g., a mastertransport key and/or master protection key) for deriving thecorresponding derived key (e.g., the corresponding upload transport keyand/or the corresponding data protection key).

In one or more embodiments, the recipient device can be a removablememory device (e.g., a memory stick) having a connection port (e.g., aUSB port) to enable a physical coupling with the communication device,and the secure device processor can provide encrypted modified data tothe removable memory device via the connection port to enable therecipient device to be removed from the mobile communication device andsubsequently coupled with an end user device for transmission of theencrypted modified data to the end user device to enable the end userdevice to perform a decryption of the encrypted modified data utilizinga corresponding upload transport key.

FIG. 7 depicts an illustrative embodiment of a communication system 700for delivering media content. The communication system 700 can representan Internet Protocol Television (IPTV) media system. Communicationsystem 700 can be overlaid or operably coupled with systems 100, 200 ofFIGS. 1 and 2 as another representative embodiment of communicationsystem 700. In one or more embodiments, system 700 enables utilizingboth the secure element and secure device processor together to providea secure platform for uploading or otherwise delivering data to arecipient device where the data is encrypted and modified utilizingderived keys that are generated from master keys having limitedaccessibility.

System 700 can enable data (e.g., video content, image content, audiocontent, application data, gaming data, and so forth) to be securelyuploaded from a mobile communication device responsive to a request thatis initiated by a user, by the mobile communication device, by a networkdevice (e.g., the application server), and/or by another communicationdevice (e.g., another end user device). In one or more embodiments, datacan be modified before transmission. This modification may includeencryption, and/or the addition of information, such as authenticationdata, permissions, and other types of information. In one or moreembodiments, the secure device processor can perform the modification ofthe data and the transmission of the modified and/or encrypted data. Inone or more embodiments, a set of master keys can be stored in thesecure element, which may exist in the form of a UICC. A subset of thesekeys can be stored in another device, such as the application server. Inone or more embodiments, keys derived from the master keys can be usedto modify the data for transmission.

In one or more embodiments of the system 700, master keys, which arestored at the UICC, do not leave the UICC. In one or more embodiments,the application server or other recipient device may unmodify the datadepending on the keys accessible to it or otherwise in its possession.In one or more embodiments, the user can be authenticated to the UICC,the UICC can be mutually authenticated with the secure device processor,and the UICC can be mutually authenticated with the application server(or other intended recipient device). In one or more embodiments, anauthentication function can be used. In one or more embodiments, thedata can already be stored within the device. In one or moreembodiments, the functions within the mobile communication device can bemanaged remotely by the remote management server. In one or moreembodiments, the master keys can be provisioned remotely by the remotemanagement server. In one or more embodiments, the master keys can beloaded into the secure element from the network using a very highsecurity process based on GlobalPlatform. This path can be separate andisolated from the path (e.g., a data channel) in which data is uploadedfrom the mobile communication device. In one or more embodiments,uploaded data may be “owned” either by the user or by the networkadministrator.

The IPTV media system can include a super head-end office (SHO) 710 withat least one super headend office server (SHS) 711 which receives mediacontent from satellite and/or terrestrial communication systems. In thepresent context, media content can represent, for example, audiocontent, moving image content such as 2D or 3D videos, video games,virtual reality content, still image content, and combinations thereof.The SHS server 711 can forward packets associated with the media contentto one or more video head-end servers (VHS) 714 via a network of videohead-end offices (VHO) 712 according to a multicast communicationprotocol.

The VHS 714 can distribute multimedia broadcast content via an accessnetwork 718 to commercial and/or residential buildings 702 housing agateway 704 (such as a residential or commercial gateway). The accessnetwork 718 can represent a group of digital subscriber line accessmultiplexers (DSLAMs) located in a central office or a service areainterface that provide broadband services over fiber optical links orcopper twisted pairs 719 to buildings 702. The gateway 704 can usecommunication technology to distribute broadcast signals to mediaprocessors 706 such as Set-Top Boxes (STBs) which in turn presentbroadcast channels to media devices 708 such as computers or televisionsets managed in some instances by a media controller 707 (such as aninfrared or RF remote controller).

The gateway 704, the media processors 706, and media devices 708 canutilize tethered communication technologies (such as coaxial, powerlineor phone line wiring) or can operate over a wireless access protocolsuch as Wireless Fidelity (WiFi), Bluetooth®, Zigbee®, or other presentor next generation local or personal area wireless network technologies(Bluetooth® and ZigBee® are trademarks registered by the BluetoothSpecial Interest Group and the ZigBee Alliance, respectively). By way ofthese interfaces, unicast communications can also be invoked between themedia processors 706 and subsystems of the IPTV media system forservices such as video-on-demand (VoD), browsing an electronicprogramming guide (EPG), or other infrastructure services.

A satellite broadcast television system 729 can be used in the mediasystem of FIG. 7. The satellite broadcast television system can beoverlaid, operably coupled with, or replace the IPTV system as anotherrepresentative embodiment of communication system 700. In thisembodiment, signals transmitted by a satellite 715 that include mediacontent can be received by a satellite dish receiver 731 coupled to thebuilding 702. Modulated signals received by the satellite dish receiver731 can be transferred to the media processors 706 for demodulating,decoding, encoding, and/or distributing broadcast channels to the mediadevices 708. The media processors 706 can be equipped with a broadbandport to an Internet Service Provider (ISP) network 732 to enableinteractive services such as VoD and EPG as described above.

In yet another embodiment, an analog or digital cable broadcastdistribution system such as cable TV system 733 can be overlaid,operably coupled with, or replace the IPTV system and/or the satelliteTV system as another representative embodiment of communication system700. In this embodiment, the cable TV system 733 can also provideInternet, telephony, and interactive media services.

The subject disclosure can apply to other present or next generationover-the-air and/or landline media content services system.

Some of the network elements of the IPTV media system can be coupled toone or more computing devices 730, a portion of which can operate as aweb server for providing web portal services over the ISP network 732 towireline media devices 708 or wireless communication devices 716.

Communication system 700 can also provide for computing devices 730 tofunction as a remote management server and/or an application server(herein referred to as server 730). The server 730 can use computing andcommunication technology to perform function 762, which can includeamong other things, provisioning various devices or components, such asthrough use of remote management keysets. The provisioning can be ofapplications, such as the secure upload management function and/or thesecure upload engine, and/or can be of keysets, such as master keys,upload transport keys, data protection keys, and so forth. Function 762can include one or more of providing an upload request to a mobilecommunication device to cause a secure device processor of the mobilecommunication device to perform a first encryption of data according toa data protection key to generate a single encrypted data and to performa second encryption of the single encrypted data according to an uploadtransport key to generate a double encrypted data where the secureelement receives master keys from a remote management server and storesthe master keys to enable the upload transport key and the dataprotection key to be generated by the secure element without providingthe master keys to the secure device processor, receiving the doubleencrypted data, obtaining a corresponding upload transport key,decrypting the double encrypted data utilizing the corresponding uploadtransport key to obtain the single encrypted data, and storing thesingle encrypted data in a memory accessible to the server. In oneembodiment, the obtaining of the corresponding upload transport key caninclude receiving a master transport key, generating the correspondingupload transport key from the master transport key.

Function 762 can also include deleting the corresponding uploadtransport key after the decrypting of the double encrypted data. In oneembodiment, the obtaining of the corresponding upload transport key caninclude receiving, from a remote management server, the correspondingupload transport key, and the function 762 can include deleting thecorresponding upload transport key after the decrypting of the doubleencrypted data. In one embodiment, the server 730 may not have access toa corresponding data protection key for decrypting the single encrypteddata, and function 762 can include receiving from the mobilecommunication device a download request associated with the data,generating a second upload transport key from a master transport keyreceived from the remote management server where the obtaining of thecorresponding upload transport key comprises deriving the correspondingupload transport key from the master transport key, encrypting thesingle encrypted data using the second upload transport key to generatethe double encrypted data, and providing the double encrypted data tothe mobile communication device to enable the secure device processor todecrypt the double encrypted data utilizing a corresponding secondtransport key generated by the secure element from the master keyswithout providing the master keys to the secure device processor.

Function 762 can include receiving from the remote management server amaster protection key, storing the master protection key, generating acorresponding data protection key from the master protection key,decrypting the single encrypted data utilizing the corresponding dataprotection key to obtain the data, and deleting the corresponding dataprotection key after the decrypting of the single encrypted data.Function 762 receiving from the remote management server a correspondingdata protection key, decrypting the single encrypted data utilizing thecorresponding data protection key to obtain the data, and deleting thecorresponding data protection key after the decrypting of the singleencrypted data.

Function 766 can include functions being performed at the secure element108 including one or more of receiving master keys from a remotemanagement server, storing the master keys in the secure element memory,generating an upload transport key and a data protection key from themaster keys, mutually authenticating with the secure device processor106, or receiving a request from the secure device processor for theupload transport key and the data protection key where the generating ofthe upload transport key and the data protection key is in response tothe request from the secure device processor.

Function 766 can also include functions being performed at the SDP 106such as one or more of requesting an upload transport key and a dataprotection key from a secure element of the mobile communication devicewhere the secure element 108 stores master keys from which the uploadtransport key and the data protection key are generated by the secureelement, receiving the upload transport key and the data protection keywithout receiving the master keys, obtaining data for transmission to arecipient device, encrypting the data using the data protection key togenerate a single encrypted data, encrypting the single encrypted datausing the upload transport key to generate a double encrypted data,receiving an upload request received via a user interface of the mobilecommunication device where the obtaining of the data is in response tothe receiving of the upload request, receiving a user credential via theuser interface, providing the user credential to the secure element,receiving a user authentication from the secure element, wherein therequesting of the upload transport key and the data protection key fromthe secure element is responsive to the receiving of the userauthentication, facilitating establishing a communication channel withthe recipient device, providing the double encrypted data over thecommunication channel to the recipient device to enable the recipientdevice to perform a first decryption of the double encrypted datautilizing a corresponding upload transport key, receiving an uploadrequest from one of the recipient device, another communication device,an application being executed by the mobile communication device, or auser input received at the mobile communication device where theobtaining of the data is in response to the receiving of the uploadrequest, or providing the double encrypted data to the removable memorydevice via the connection port to enable the recipient device to beremoved from the mobile communication device and subsequently coupledwith an end user device for transmission of the double encrypted data tothe end user device to enable the end user device to perform a firstdecryption of the double encrypted data utilizing a corresponding uploadtransport key.

System 700 can include a memory device 799, which is depicted as a USBcompatible memory stick, although other memory devices that can bephysically connected with communication devices can also be utilized.Memory device 799 can perform all or a portion of functions 766 toenable the secure upload or delivery of data which the memory device 799receives from a mobile communication device. As an example, the memorydevice 799 can have a connection port to enable a physical coupling witha mobile communication device, and the mobile communication device canproviding double encrypted data to the removable memory device 799 viathe connection port (e.g., USB port) to enable the memory device 799 tobe removed from the mobile communication device and subsequently coupledwith an end user device for transmission of the double encrypted data tothe end user device to enable the end user device to perform a firstdecryption of the double encrypted data utilizing a corresponding uploadtransport key.

Multiple forms of media services can be offered to media devices overlandline technologies such as those described above. Additionally, mediaservices can be offered to media devices by way of a wireless accessbase station 717 operating according to common wireless access protocolssuch as Global System for Mobile or GSM, Code Division Multiple Accessor CDMA, Time Division Multiple Access or TDMA, Universal MobileTelecommunications or UMTS, World interoperability for Microwave orWiMAX, Software Defined Radio or SDR, Long Term Evolution or LTE, and soon. Other present and next generation wide area wireless access networktechnologies can be used in one or more embodiments of the subjectdisclosure.

FIG. 8 depicts an illustrative embodiment of a communication device 800.Communication device 800 can serve in whole or in part as anillustrative embodiment of the devices depicted in FIGS. 1-5 and 7. Forinstance, device 800 can include a secure element (e.g., executing anadministrative agent key function) and a secure device processor(executing an administrative agent function) in the secure servicesplatform 110 which perform the functions described in the exemplaryembodiments herein.

In one or more embodiments, the secure element of device 800 can performoperations including receiving master keys from a remote managementserver, storing the master keys in the secure element memory, andgenerating derivative keys (e.g., an upload transport key and a dataprotection key) from the master keys. The derivative keys can beprovided to the secure device processor of device 800 without providingthe master keys to enable the secure device processor to change ormanipulate the data, such as encryption(s), modification(s), and soforth.

In one or more embodiments, the secure device processor of device 800can perform operations including receiving the derivative keys (e.g.,the upload transport key and the data protection key) from the secureelement without receiving the master keys, obtaining data fortransmission to a recipient device, modifying the data using the dataprotection key to generate modified data, and encrypting the modifieddata (e.g., using the upload transport key) to generate an encryptedmodified data. The secure device processor of device 800 can provide arequest to the secure element for the derivative keys, such as theupload transport key and the data protection key, where the generatingof the derivative keys, such as the upload transport key and the dataprotection key, is in response to the request from the secure deviceprocessor. In one or more embodiments, the secure device processor canreceive an upload request received via a user interface where theobtaining of the data is in response to the receiving of the uploadrequest, receive a user credential via the user interface, provide theuser credential to the secure element, receive a user authenticationfrom the secure element, and request the derivative keys, such as theupload transport key and the data protection key, from the secureelement in response to the receiving of the user authentication. In oneor more embodiments, the secure device processor can provide theencrypted modified data over a communication channel to the recipientdevice to enable the recipient device to perform a decryption of theencrypted modified data utilizing a corresponding upload transport key.In one or more embodiments, the secure device processor can provide theencrypted modified data to the removable memory device via theconnection port to enable the recipient device to be removed from thecommunication device and subsequently coupled with an end user devicefor transmission of the encrypted modified data to the end user deviceto enable the end user device to perform a decryption of the encryptedmodified data utilizing a corresponding upload transport key.

To enable these features, communication device 800 can comprise awireline and/or wireless transceiver 802 (herein transceiver 802), auser interface (UI) 804, a power supply 814, a location receiver 816, amotion sensor 818, an orientation sensor 820, and a controller 806 formanaging operations thereof. The transceiver 802 can support short-rangeor long-range wireless access technologies such as Bluetooth®, ZigBee®,WiFi, DECT, or cellular communication technologies, just to mention afew. Cellular technologies can include, for example, CDMA-1X,UMTS/HSDPA, GSM/GPRS, TDMA/EDGE, EV/DO, WiMAX, SDR, LTE, NFC, as well asother next generation wireless communication technologies as they arise.The transceiver 802 can also be adapted to support circuit-switchedwireline access technologies (such as PSTN), packet-switched wirelineaccess technologies (such as TCP/IP, VoIP, etc.), and combinationsthereof.

The UI 804 can include a depressible or touch-sensitive keypad 808 witha navigation mechanism such as a roller ball, a joystick, a mouse, or anavigation disk for manipulating operations of the communication device800. The keypad 808 can be an integral part of a housing assembly of thecommunication device 800 or an independent device operably coupledthereto by a tethered wireline interface (such as a USB cable) or awireless interface supporting for example Bluetooth®. The keypad 808 canrepresent a numeric keypad commonly used by phones, and/or a QWERTYkeypad with alphanumeric keys. The UI 804 can further include a display810 such as monochrome or color LCD (Liquid Crystal Display), OLED(Organic Light Emitting Diode) or other suitable display technology forconveying images to an end user of the communication device 800. In anembodiment where the display 810 is touch-sensitive, a portion or all ofthe keypad 808 can be presented by way of the display 810 withnavigation features.

The display 810 can use touch screen technology to also serve as a userinterface for detecting user input. As a touch screen display, thecommunication device 800 can be adapted to present a user interface withgraphical user interface (GUI) elements that can be selected by a userwith a touch of a finger. The touch screen display 810 can be equippedwith capacitive, resistive or other forms of sensing technology todetect how much surface area of a user's finger has been placed on aportion of the touch screen display. This sensing information can beused to control the manipulation of the GUI elements or other functionsof the user interface. The display 810 can be an integral part of thehousing assembly of the communication device 800 or an independentdevice communicatively coupled thereto by a tethered wireline interface(such as a cable) or a wireless interface.

The UI 804 can also include an audio system 812 that utilizes audiotechnology for conveying low volume audio (such as audio heard inproximity of a human ear) and high volume audio (such as speakerphonefor hands free operation). The audio system 812 can further include amicrophone for receiving audible signals of an end user. The audiosystem 812 can also be used for voice recognition applications. The UI804 can further include an image sensor 813 such as a charged coupleddevice (CCD) camera for capturing still or moving images.

The power supply 814 can utilize common power management technologiessuch as replaceable and rechargeable batteries, supply regulationtechnologies, and/or charging system technologies for supplying energyto the components of the communication device 800 to facilitatelong-range or short-range portable applications. Alternatively, or incombination, the charging system can utilize external power sources suchas DC power supplied over a physical interface such as a USB port orother suitable tethering technologies.

The location receiver 816 can utilize location technology such as aglobal positioning system (GPS) receiver capable of assisted GPS foridentifying a location of the communication device 800 based on signalsgenerated by a constellation of GPS satellites, which can be used forfacilitating location services such as navigation. The motion sensor 818can utilize motion sensing technology such as an accelerometer, agyroscope, or other suitable motion sensing technology to detect motionof the communication device 800 in three-dimensional space. Theorientation sensor 820 can utilize orientation sensing technology suchas a magnetometer to detect the orientation of the communication device800 (north, south, west, and east, as well as combined orientations indegrees, minutes, or other suitable orientation metrics).

The communication device 800 can use the transceiver 802 to alsodetermine a proximity to a cellular, WiFi, Bluetooth®, or other wirelessaccess points by sensing techniques such as utilizing a received signalstrength indicator (RSSI) and/or signal time of arrival (TOA) or time offlight (TOF) measurements. The controller 806 can utilize computingtechnologies such as a microprocessor, a digital signal processor (DSP),programmable gate arrays, application specific integrated circuits,and/or a video processor with associated storage memory such as Flash,ROM, RAM, SRAM, DRAM or other storage technologies for executingcomputer instructions, controlling, and processing data supplied by theaforementioned components of the communication device 800.

Other components not shown in FIG. 8 can be used in one or moreembodiments of the subject disclosure. For instance, the communicationdevice 800 can include a reset button (not shown). The reset button canbe used to reset the controller 806 of the communication device 800. Inyet another embodiment, the communication device 800 can also include afactory default setting button positioned, for example, below a smallhole in a housing assembly of the communication device 800 to force thecommunication device 800 to re-establish factory settings. In thisembodiment, a user can use a protruding object such as a pen or paperclip tip to reach into the hole and depress the default setting button.In one embodiment, the communication device 800 can also include a slotfor adding or removing the UICC.

The communication device 800 as described herein can operate with moreor less of the circuit components shown in FIG. 8. These variantembodiments can be used in one or more embodiments of the subjectdisclosure.

The communication device 800 can be adapted to perform the functions ofthe media processor 706, the media devices 708, the portablecommunication devices 716 and/or the server 730 of FIG. 7. It will beappreciated that the communication device 800 can also represent otherdevices that can operate in communication system 700 of FIG. 7, such asa gaming console and a media player.

The communication device 800 shown in FIG. 8 or portions thereof canserve as a representation of one or more of the devices of FIGS. 1-5 and7 including end user devices, removable memory devices, customerpremises equipment, remote management servers, application servers, andso forth. In one or more embodiments, the recipient device can beservers operated by, or otherwise affiliated with, a third party entitythat is different from and/or independent of the service provideroperating the remote management server. In addition, the controller 806can perform the functions 762 and/or 766.

Upon reviewing the aforementioned embodiments, it would be evident to anartisan with ordinary skill in the art that said embodiments can bemodified, reduced, or enhanced without departing from the scope of theclaims described below.

For example, the derivative key(s) can be one-time use keys which aredeleted or otherwise rendered inoperable after being applied to thedata, such as for encryption, modification, decryption and/orun-modification.

In one embodiment, encryption can be applied based on elliptical curvecryptography, Advance Encryption Standard (AES), and so forth. Otherencryption techniques can be utilized, including symmetrical and/orasymmetrical cryptographic methods. In another embodiment, the secureelement 108 can communicate with the recipient device forsynchronization of the derivation of keys (e.g., the derivation of theupload transport key and the data protection key) from the master keys.

In one or more embodiments, the “master key” (e.g., the master transportkey or the mast protection key) can be a static key that is derived orotherwise generated by the remote management server 120 from “a MasterKey” and transported to the secure element 108 (e.g., the UICC) and/orthe recipient device 150 (e.g., the application server). For example,the following key hierarchy can be used:

Master Key [RMS]->Derived Key [UICC, AS] (e.g., the “master key”,“master transport key”, “master upload transport keyset”, “master dataprotection keyset”)->Temporary Keys [SDP, AS] (e.g., the “uploadtransport key”, “data protection key”, “derived key”).

Other embodiments can be used in the subject disclosure.

It should be understood that devices described in the exemplaryembodiments can be in communication with each other via various wirelessand/or wired methodologies. The methodologies can be links that aredescribed as coupled, connected and so forth, which can includeunidirectional and/or bidirectional communication over wireless pathsand/or wired paths that utilize one or more of various protocols ormethodologies, where the coupling and/or connection can be direct (e.g.,no intervening processing device) and/or indirect (e.g., an intermediaryprocessing device such as a router).

FIG. 9 depicts an exemplary diagrammatic representation of a machine inthe form of a computer system 900 within which a set of instructions,when executed, may cause the machine to perform any one or more of themethods described above. One or more instances of the machine canprovide for secure upload or delivery of data from a mobilecommunication device to a recipient device utilizing various keysets,such as the upload transport keys and the data protection keys. One ormore instances of the machine can operate, for example, as the mobilecommunication device, the application server, the recipient device, therecipient end user device, the recipient removable memory device, theremote management server, the secure services platform (e.g., the secureelement and/or the SDP), the device processor, and so forth. In someembodiments, the machine may be connected (e.g., using a network 926) toother machines. In a networked deployment, the machine may operate inthe capacity of a server or a client user machine in server-client usernetwork environment, or as a peer machine in a peer-to-peer (ordistributed) network environment.

The machine may comprise a server computer, a client user computer, apersonal computer (PC), a tablet PC, a smart phone, a laptop computer, adesktop computer, a control system, a network router, switch or bridge,or any machine capable of executing a set of instructions (sequential orotherwise) that specify actions to be taken by that machine. It will beunderstood that a communication device of the subject disclosureincludes broadly any electronic device that provides voice, video ordata communication. Further, while a single machine is illustrated, theterm “machine” shall also be taken to include any collection of machinesthat individually or jointly execute a set (or multiple sets) ofinstructions to perform any one or more of the methods discussed herein.

The computer system 900 may include a processor (or controller) 902(e.g., a central processing unit (CPU)), a graphics processing unit(GPU, or both), a main memory 904 and a static memory 906, whichcommunicate with each other via a bus 908. The computer system 900 mayfurther include a display unit 910 (e.g., a liquid crystal display(LCD), a flat panel, or a solid state display). The computer system 900may include an input device 912 (e.g., a keyboard), a cursor controldevice 914 (e.g., a mouse), a disk drive unit 916, a signal generationdevice 918 (e.g., a speaker or remote control) and a network interfacedevice 920. In distributed environments, the embodiments described inthe subject disclosure can be adapted to utilize multiple display units910 controlled by two or more computer systems 900. In thisconfiguration, presentations described by the subject disclosure may inpart be shown in a first of the display units 910, while the remainingportion is presented in a second of the display units 910.

The disk drive unit 916 may include a tangible computer-readable storagemedium 922 on which is stored one or more sets of instructions (e.g.,software 924) embodying any one or more of the methods or functionsdescribed herein, including those methods illustrated above. Theinstructions 924 may also reside, completely or at least partially,within the main memory 904, the static memory 906, and/or within theprocessor 902 during execution thereof by the computer system 900. Themain memory 904 and the processor 902 also may constitute tangiblecomputer-readable storage media.

Dedicated hardware implementations including, but not limited to,application specific integrated circuits, programmable logic arrays andother hardware devices that can likewise be constructed to implement themethods described herein. Application specific integrated circuits andprogrammable logic array can use downloadable instructions for executingstate machines and/or circuit configurations to implement embodiments ofthe subject disclosure. Applications that may include the apparatus andsystems of various embodiments broadly include a variety of electronicand computer systems. Some embodiments implement functions in two ormore specific interconnected hardware modules or devices with relatedcontrol and data signals communicated between and through the modules,or as portions of an application-specific integrated circuit. Thus, theexample system is applicable to software, firmware, and hardwareimplementations.

In accordance with various embodiments of the subject disclosure, theoperations or methods described herein are intended for operation assoftware programs or instructions running on or executed by a computerprocessor or other computing device, and which may include other formsof instructions manifested as a state machine implemented with logiccomponents in an application specific integrated circuit or fieldprogrammable gate array. Furthermore, software implementations (e.g.,software programs, instructions, etc.) including, but not limited to,distributed processing or component/object distributed processing,parallel processing, or virtual machine processing can also beconstructed to implement the methods described herein. It is furthernoted that a computing device such as a processor, a controller, a statemachine or other suitable device for executing instructions to performoperations or methods may perform such operations directly or indirectlyby way of one or more intermediate devices directed by the computingdevice.

While the tangible computer-readable storage medium 922 is shown in anexample embodiment to be a single medium, the term “tangiblecomputer-readable storage medium” should be taken to include a singlemedium or multiple media (e.g., a centralized or distributed database,and/or associated caches and servers) that store the one or more sets ofinstructions. The term “tangible computer-readable storage medium” shallalso be taken to include any non-transitory medium that is capable ofstoring or encoding a set of instructions for execution by the machineand that cause the machine to perform any one or more of the methods ofthe subject disclosure. The term “non-transitory” as in a non-transitorycomputer-readable storage includes without limitation memories, drives,devices and anything tangible but not a signal per se.

The term “separate” can include a component or device that is logicallyand/or physically separate from another component or device, which caninclude components/devices that operate independently of each otherwhile being in communication with each other. In one or moreembodiments, devices can be separate in that they do not share anycommon component (although such separate devices can be in communicationwith each other such as via an electrode coupling). In one or moreembodiments, devices can be separate in that they each have one or morecomponents that are not shared between each other but have one or morecomponents that may be shared with each other.

The term “tangible computer-readable storage medium” shall accordinglybe taken to include, but not be limited to: solid-state memories such asa memory card or other package that houses one or more read-only(non-volatile) memories, random access memories, or other re-writable(volatile) memories, a magneto-optical or optical medium such as a diskor tape, or other tangible media which can be used to store information.Accordingly, the disclosure is considered to include any one or more ofa tangible computer-readable storage medium, as listed herein andincluding art-recognized equivalents and successor media, in which thesoftware implementations herein are stored.

Although the present specification describes components and functionsimplemented in the embodiments with reference to particular standardsand protocols, the disclosure is not limited to such standards andprotocols. Each of the standards for Internet and other packet switchednetwork transmission (e.g., TCP/IP, UDP/IP, HTML, HTTP, NFC) representexamples of the state of the art. Such standards are from time-to-timesuperseded by faster or more efficient equivalents having essentiallythe same functions. Wireless standards for device detection (e.g.,RFID), short-range communications (e.g., Bluetooth®, WiFi, Zigbee®,NFC), and long-range communications (e.g., WiMAX, GSM, CDMA, LTE) can beused by computer system 900.

The illustrations of embodiments described herein are intended toprovide a general understanding of the structure of various embodiments,and they are not intended to serve as a complete description of all theelements and features of apparatus and systems that might make use ofthe structures described herein. Many other embodiments will be apparentto those of skill in the art upon reviewing the above description. Theexemplary embodiments can include combinations of features and/or stepsfrom multiple embodiments. Other embodiments may be utilized and derivedtherefrom, such that structural and logical substitutions and changesmay be made without departing from the scope of this disclosure. Figuresare also merely representational and may not be drawn to scale. Certainproportions thereof may be exaggerated, while others may be minimized.Accordingly, the specification and drawings are to be regarded in anillustrative rather than a restrictive sense.

Although specific embodiments have been illustrated and describedherein, it should be appreciated that any arrangement calculated toachieve the same purpose may be substituted for the specific embodimentsshown. This disclosure is intended to cover any and all adaptations orvariations of various embodiments. Combinations of the aboveembodiments, and other embodiments not specifically described herein,can be used in the subject disclosure. In one or more embodiments,features that are positively recited can also be excluded from theembodiment with or without replacement by another component or step. Thesteps or functions described with respect to the exemplary processes ormethods can be performed in any order. The steps or functions describedwith respect to the exemplary processes or methods can be performedalone or in combination with other steps or functions (from otherembodiments or from other steps that have not been described).

Less than all of the steps or functions described with respect to theexemplary processes or methods can also be performed in one or more ofthe exemplary embodiments. Further, the use of numerical terms todescribe a device, component, step or function, such as first, second,third, and so forth, is not intended to describe an order or functionunless expressly stated so. The use of the terms first, second, thirdand so forth, is generally to distinguish between devices, components,steps or functions unless expressly stated otherwise. Additionally, oneor more devices or components described with respect to the exemplaryembodiments can facilitate one or more functions, where the facilitating(e.g., facilitating access or facilitating establishing a connection)can include less than every step needed to perform the function or caninclude all of the steps needed to perform the function.

In one or more embodiments, a processor (which can include a controlleror circuit) has been described that performs various functions. Itshould be understood that the processor can be multiple processors,which can include distributed processors or parallel processors in asingle machine or multiple machines. The processor can be used insupporting a virtual processing environment. The virtual processingenvironment may support one or more virtual machines representingcomputers, servers, or other computing devices. In such virtualmachines, components such as microprocessors and storage devices may bevirtualized or logically represented. The processor can include a statemachine, application specific integrated circuit, and/or programmablegate array including a Field PGA. In one or more embodiments, when aprocessor executes instructions to perform “operations”, this caninclude the processor performing the operations directly and/orfacilitating, directing, or cooperating with another device or componentto perform the operations.

The Abstract of the Disclosure is provided with the understanding thatit will not be used to interpret or limit the scope or meaning of theclaims. In addition, in the foregoing Detailed Description, it can beseen that various features are grouped together in a single embodimentfor the purpose of streamlining the disclosure. This method ofdisclosure is not to be interpreted as reflecting an intention that theclaimed embodiments require more features than are expressly recited ineach claim. Rather, as the following claims reflect, inventive subjectmatter lies in less than all features of a single disclosed embodiment.Thus the following claims are hereby incorporated into the DetailedDescription, with each claim standing on its own as a separately claimedsubject matter.

What is claimed is:
 1. A method, comprising: receiving, by a processingsystem including a processor, a master transport key from a remotemanagement server; generating, by the processing system, a correspondingupload transport key from the master transport key; receiving, by theprocessing system, double encrypted data from a communication device,wherein the double encrypted data is generated from data based on a dataprotection key, wherein the data protection key is used in a firstencryption to generate a single encrypted data and a second encryptionof the single encrypted data is generated according to an uploadtransport key; decrypting, by the processing system, the doubleencrypted data utilizing the corresponding upload transport key toobtain the single encrypted data; receiving, by the processing system, amaster protection key from the remote management server; storing, by theprocessing system, the master protection key; generating, by theprocessing system, a corresponding data protection key from the masterprotection key; and decrypting, by the processing system, the singleencrypted data utilizing the corresponding data protection key to obtainthe data, wherein a Universal Integrated Circuit Card (UICC) of thecommunication device receives the master transport key and the masterprotection key over a network from the remote management server, andwherein the communication device includes a secure device processorseparate from and in communication with the UICC, wherein the UICC andthe secure device processor are separate components in communicationwith each other.
 2. The method of claim 1, wherein the remote managementserver stores the master transport key and the master protection key toenable the upload transport key and the data protection key to begenerated.
 3. The method of claim 1, further comprising: deleting, bythe processing system, the corresponding upload transport key after thedecrypting of the double encrypted data.
 4. The method of claim 1,further comprising: storing, by the processing system, the singleencrypted data in a memory accessible to the processing system.
 5. Themethod of claim 4, further comprising: deleting, by the processingsystem, the corresponding data protection key after the decrypting ofthe single encrypted data.
 6. The method of claim 3, wherein thecorresponding upload transport key and the upload transport key are asame key.
 7. The method of claim 1, wherein the UICC provides the uploadtransport key and the data protection key to the secure device processorwithout providing the master transport key and the master protection keyto the secure device processor.
 8. The method of claim 1, wherein theUICC and the secure device processor perform a mutual authenticationprocedure utilizing a keyset received via the remote management server.9. A device, comprising: a processing system including a processor; anda memory that stores executable instructions that, when executed by theprocessing system, facilitate performance of operations comprising:receiving a master transport key from a remote management server;generating a corresponding upload transport key from the mastertransport key; receiving double encrypted data from a communicationdevice, wherein the double encrypted data is generated from data basedon a data protection key that generates a single encrypted data and asecond encryption of the single encrypted data according to an uploadtransport key; receiving a master protection key from the remotemanagement server; storing the master protection key; generating acorresponding data protection key from the master protection key; anddecrypting the single encrypted data utilizing the corresponding dataprotection key to obtain the data, wherein the communication deviceincludes a Universal Integrated Circuit Card (UICC) and a secure deviceprocessor separate from and in communication with the UICC, and whereinthe UICC receives the master transport key and the master protection keyover a network from the remote management server.
 10. The device ofclaim 9, wherein the remote management server stores the mastertransport key and the master protection key to enable the uploadtransport key and the data protection key to be generated, and whereinthe operations further comprise: decrypting the double encrypted datautilizing the corresponding upload transport key to obtain the singleencrypted data; and storing the single encrypted data in a memoryaccessible to the processing system.
 11. The device of claim 10, whereinthe operations further comprise: deleting the corresponding uploadtransport key after the decrypting of the double encrypted data.
 12. Thedevice of claim 9, wherein the corresponding upload transport key andthe upload transport key are a same key.
 13. The device of claim 9,wherein the operations further comprise: deleting the corresponding dataprotection key after the decrypting of the single encrypted data. 14.The device of claim 9, wherein the UICC provides the upload transportkey and the data protection key to the secure device processor withoutproviding the master transport key and the master protection key to thesecure device processor.
 15. A machine-readable storage mediumcomprising executable instructions that, when executed by a processingsystem including a processor, facilitate performance of operationscomprising: receiving a master transport key from a remote managementserver; generating a corresponding upload transport key from the mastertransport key; and receiving double encrypted data from a communicationdevice, wherein the double encrypted data is generated from data basedon a data protection key that generates a single encrypted data and asecond encryption of the single encrypted data according to an uploadtransport key; receiving, by the processing system, a master protectionkey from the remote management server; storing, by the processingsystem, the master protection key; generating, by the processing system,a corresponding data protection key from the master protection key; anddecrypting, by the processing system, the single encrypted datautilizing the corresponding data protection key to obtain the data,wherein the communication device includes Universal Integrated CircuitCard (UICC) and a secure device processor separate from and incommunication with the UICC, wherein the UICC and the secure deviceprocessor perform a mutual authentication procedure utilizing a keysetreceived via the remote management server, and wherein the UICC receivesthe master transport key and the master protection key over a networkfrom the remote management server.
 16. The machine-readable storagemedium of claim 15, wherein the remote management server stores themaster transport key and the master protection key to enable the uploadtransport key and the data protection key to be generated, and whereinthe operations further comprise: decrypting the double encrypted datautilizing the corresponding upload transport key to obtain the singleencrypted data; and storing the single encrypted data in a memoryaccessible to the processing system.
 17. The machine-readable storagemedium of claim 16, wherein the operations further comprise: deletingthe corresponding upload transport key after the decrypting of thedouble encrypted data.
 18. The machine-readable storage medium of claim17, wherein the corresponding upload transport key and the uploadtransport key are a same key.
 19. The machine-readable storage medium ofclaim 15, wherein the operations further comprise: deleting thecorresponding data protection key after the decrypting of the singleencrypted data.
 20. The machine-readable storage medium of claim 15,wherein the UICC provides the upload transport key and the dataprotection key to the secure device processor without providing themaster transport key and the master protection key to the secure deviceprocessor.